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IN THE CLAIMS 

Aroendments to the riftiins 

This listing of claims will replace all prior versions, and listings, of the claims: 

1. (Currently Amended) A network usage system having a multiple level distributed data 
storage system, the system comprising: 

a set of first level network data collectors, wherein each first level network data collector 
receives network accounting data from a network data source, processes and 
stores the network accounting data at the first level network data collector; and 
a second level network data collector, wherein the second level network data collector 

receives processed network accounting data firom one or more first level network 
data collectors, processes and stores the network accounting data at the second 
level network data collector T: and 
wherein each first leve l network data collector includes a first level data storage system 
and the s econd level network data collector includes a second level data storage system, for 
storing processed ne twork accounting data, wherein the first level data storage system and the 
second level data storage system each include a processed data storage location, a metadata 
storage lo cation and an error recovery information storage location, wherein the processed 
network accoimthig data is stored at the processed data storage location. 

2. (Original) The system of claim 1 , further comprising a third level network data collector, 
wherein the third level network data collector receives processed network accounting data fi-om 
the first level network data collector or the second level network data collector, processes and 
stores the network accounting data at the third level network data collector. 
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3. (Original) The system of claim 2, further comprising an application interface which 
receives processed network accounting data from the first level network data coDector, the 
second level network data collector, or the third level network data collector. 

4. (Original) The system of claim 1 , wherein the first level network data collector includes 
a query manager, and wherein the second level network data collector is in conmiunication with 
the first level network data collector via the query manager. 

5. (Original) The system of claim 1» wherein the first level netwcwrk data collector converts 
the network accounting data to a standard data format. 

6. (Cancelled) 

7. (Cancelled) 

8. (Cuirently Amended) The system of claim ^l, wherein after storing of the processed 
network accounting data, corresponding metadata is transferred to the metadata storage location 
and error recovery information is transferred to the error recovery information location. 

9. (CurrenUy Amended) The system of claim 61 , wherein the first level data storage system 
includes a first level aging policy, wherein network accounting data is removed from the first 
level data storage system after a time period corresponding to the first level aging policy. 

10. (Original) The system of claim 9, wherein the second level data storage system includes 
a second level aging policy different from the first level aging policy, wherein the network 
accounting data is removed from the second level data storage system after a time period 
corresponding to the second level aging policy. 
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1 1 . (Withdrawn) A network usage system having a multiple level distributed data storage 
system, the system comprising: 

a first network data coUector including a first encapsulator, a first aggregator, and a first 
data storage system; 

a second network data collector including a second encapsulator, a second aggregator, 
and a second data storage system; and 

a data correlator collector including a third encapsulator. a third aggregator, and a third 
data storage system, wherein the third encapsulator is in conamunication with the 
first data storage system and the second data storage system, 

12. (Withdrawn) The system of claim 1 1 , further comprising an aggregator collector 
including a fourth encapsulator, a fourth aggregator, and a fourth data storage system, wherein 
the fourth encapsulator is in communication with the third data storage system. 

13. (Withdrawn) The system of claim 1 1, wherein the first data collector receives network 
data from a network data source, and wherein the first aggregator processes the network data. 

14. (Withdrawn) The system of claim 13, wherein the processing of the network data 
includes the process of performing data reduction on the network data. 

15. (Withdrawn) The system of claim 1 1, wherein the first data coUector receives network 
data fi-om a network data source, and wherein the first encapsulator converts the network data to 
a standard data format. 

16. (Wthdrawn) The system of claim 11, wherein the first aggregator processes the network 
data providing aggregated data, and wherein the first aggregator includes a defined data transfer 
interval such that the first aggregator transfers the aggregated data to the first data storage system 
at the data transfer interval. 
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17. (Withdrawn) The system of claim 16, wherein the data correlator collector includes a 
defined query interval, wherein the third encapsulator queries the first data storage system for the 
aggregated data at the query interval. 

18. (Withdrawn) The system of claim 17, wherein die data transfer interval is a multiple of 
the query interval. 

19. (Withdrawn) The system of claim 11, wherein the first data storage system includes an 
aggregated data storage location, a metadata storage location and an error recovery information 
storage location, wherein the aggregated data is stored at the aggregated data storage location. 

20. (Withdrawn) The system of claim 19, wherein after transfer of the aggregated data to the 
first data storage system, corresponding metadata is transferred to the metadata storage location 
and error recovery information is transferred to the error recovery information location. 

21 . (Currently Amended) A method for recording net\^ork usage including storing network 
data in a multiple level data storage system, the method comprising the steps of: 

defining a set of first level network data collectors; 

receiving a first set of network accounting data at each first level network data collector, 
processing and storing the first network accounting data set at the first level 
network data collector; 

defining a second level network data collector; 

receiving the first network accounting data set from one or more first level network data 
collectors, processing the first network accounting data set to produce a second network 
accounting data set, and storing the second network accounting data set at the second level 
network data coUector-r; 
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defining g first level aging policy for the first level network data coUector: and remnviTip 
the first network accounting data set fi-om the first level network data collector after a time 
period corresponding to the first level aging policy 

22. (Original) The method of claim 21, further comprising the steps of: 
defining a third level network data collector; and 

receiving the second network accounting data set at the third level network data collector 
from the second level network data collector, processing the second network 
accounting data set to produce a third network accounting data set, and storing the 
third network accounting data set at the third level network data coUector. 

23. (Original) The method of claim 21, further comprising the step of defining an application 
interface; and receiving the second network accounting data set at the application interface. 

24. (Original) The metiiod of claim 21, fiirther comprising the step of defining the first level 
network data collector to include a query manager, wherein the second level network data 
collector is in communication with the first level network data collector via the query manager. 

25. (Original) The method of claim 21, wherein the step of processing and storing the first 
network accounting data set via the first level network data collector further comprises the step 
of converting the first network accounting data set to a standard data format. 

26. (Original) The method of claim 21, further comprising the step of defining the first level 
network data collector to include a first level data storage system having a first processed data 
storage location, a metadata storage location and an error recovery information storage location, 
wherein the first network accounting data set is stored at the first processed data storage location. 
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27. (Original) Tlie method of claim 26, further comprising the steps of transferring metadata 
to the metadata storage location and transferring error recovery information to the error recovery 
information storage location after storing the processed first network accounting data set. 

28. (Cancelled) 

29. (Currently Amended) The method of claim ^21, fnrther comprising the step of defining 
a second level aging policy for the second level network data collector, wherein the second level 
aging policy is different than the first level aging policy. 

30. (Withdrawn) A network usage recording system having a multiple level distributed data 
storage system, the system comprising: 

a set of first level network data collectors, wherein each first level network data collector 
receives network usage information from a network data source, processes and 
stores the network usage infcnmation at the first level network data collector, 
including converting the network usage information to a standard data format; and 

a second level network data collector, wherein the second level network data collector 
receives processed network usage information converted to the standard data 
format, from one or more first level network data collectors, processes and stores 
die network usage information at the second level network data collector. 

31. (Withdrawn) The system of claim 30, further comprising a third level network data 
collector, wherein the third level network data collector receives processed network usage 
information converted to the standard data format from the first level network data collector or 
the second level network data collector, processes and stores the network usage information at 
the third level network data collector. 
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32. (Withdrawn) The system of claim 30, wherein the network usage information comprises 
at least one of network usage data or network session data, comprising at least one of a source IP 
address, a destination IP address, byte counts, packet counts, a time stamp and a usemame. 

33. (Withdrawn) The system of claim 30, wherein each first level network data collector 
comprises an encapsulator, an aggregator, and a data storage system, and the second level data 
coUector is a correlator collector including an encapsulator, an aggregator, and a data storage 
system. 

34. (Withdrawn) The system of claim 33, wherein the first level encapsulator converts the 
network usage information to a standard data format, and the aggregator processes the converted 
network usage information including performing data reduction to provide aggregated data. 

35. (Withdrawn) The system of claim 34, further comprising a query manager in 
conununication with the first level network data coUectcH- and the second level network data 
collector; and each aggregator includes a data transfer interval such that the aggregator transfers 
aggregated data to the data storage system at the data transfer interval, the query manager 
including a query interval where the second level data collector queries the first level data 
storage system for the aggregated data at the query interval via the query manager. 

36. (Currently Amended) A method for recording network usage including storing network 
data in a multiple level data storage system, the method comprising the steps of: 

defining a set of first level network data collectors; 

receiving a first set of network usage information at each first level network data 

collector, processing and storing the first network usage information set at the 
first level network data collector; 

defining a second level network data collector;-aftd 
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receiving the first network usage information set at the second level network data 

collector from one or more first level network data collectors, processing the first 
network usage information set to produce a second network usage information set, 
and storing the second network usage information set at the second level network 
data collector v: and 
defining t he first level network data collector to include a query manager: 

wherein the second level network data collector is in communication with the first 

level network data collector via the quei-y manager. 

37. (Previously Presented) The method of claim 21, where processing the first network 
usage information set includes converting the first network usage information set to a standard 
data fcMntnat, and aggregating the converted first network usage information set. 

38. (Previously Presented) The method of claim 21 , where receiving the first set of network 
usage information includes defining the network usage information to comprise at least one of 
network usage data or network session data. 

39. (Previously Presented) The method of claim 21, further comprising querying the first 
level network data collector for the processed network usage information stored at the first level 
network data collector; and transferring the processed network usage information to the second 
level network data collector. 

40. (Ciurently Amended) A network usage system having a multiple level distributed data 
storage system, the system comprising: 

a set of first level network data collectors, wherein each first level network data 
collector receives network accounting data from a network data source, processes and stores the 
network accounting data at the first level network data collector, where each network data 
collector is configured to receive network accounting data including at least one of network 
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usage data comprising source address, destination address, byte or packet counts and a time 
stamp, or network session data comprising a source address, a time stamp and a user name;-<m4 

a second level network data coDector, wh^ein the second level network data collector 
receives processed network accounting data fix>m one or more first level netwoik data collectors, 
processes and stores the network accounting data at the second level network data coUectoiv; 

wherein each first level network d ata collector includes a first level data storage system 

and tlie second level network data collector includes a second level data storage system, for 
a.toring piocessed network accounting data, wherein the first level data storage system and the 
second level data storage sys tem each include a processed data storage location, a meta data 
storage location and an error r ecovery information storage location, wherein the processed 
network accounting data is store d at the process data storage location, wherein after storing of 
the process network accounting data, corresponding mela data is transferred to the meta data 
storage location and error recovery information is D ansfened to the error recovery information 
location: 

wherein each first lev el network data collector includes a query manager, and wherein the 

second level netwoi- k data collector is in communication with the first level network data 
collector via the query manager: and 

wherein each of the fi rst level data storage systems include a first level aging policy, 

wherein network ac counting data is removed from the first level data storage system after a time 
period corresponding to the fi rst level aginf; policy, and wherein the second level data storage 
system includes a second level ag ing policy different fiom the first level aging policy, wherein 
the network accounting data i s removed from the second level data storage system after a time 
period co rresponding to the second level aging policy. 

41 . (Previously Presented) The system of claim 40. where each first level network data 
collector is configured to receive network accounting data firom an Internet network data source. 
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42. (Previously Presented) The system of claim 40, where each first level network data 
collector is configured to receive network accounting data from an intranet network data source. 



43. (Previously Piresented) The system of claim 40, where each first level network data 
collector is configured to receive network accounting data from a telephony network data source. 
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